Nothing is deployed, and that is the first fact
A security page that opens with guarantees and buries the deployment status has ordered its two most important facts backwards.
0 of 5 components exist on any chain
| Component | What it is | Chain | Address | State |
|---|---|---|---|---|
| Vault | ERC-4626 share vault | — | Not deployed | written |
| Epitaxy | v4 hook, fee harvest | — | Not deployed | written |
| Aperture | batched intent settlement | — | Not deployed | unset |
| Adductor | pause authority | — | Not deployed | unset |
| NCR | protocol token | — | Not deployed | unset |
There has been no external review of anything here. The property most worth attacking — that no privileged call can reach principal — is the one that most needs it, and it has had none.
Four properties, and one gap
The gap is in the same list. A page that lists four correct guarantees and keeps the single key that undoes two of them in a paragraph elsewhere is rule 14.
A donation cannot reprice a share
holdsAssets are tracked in a storage variable, not read back from balanceOf(address(this)). Sending tokens to the vault changes nothing for anyone holding a share.
Rests on The accounting. No key, no oracle, no assumption.
The first depositor cannot round the second to zero
holdsA virtual share and virtual asset offset the ratio, so the classic inflation attack — deposit one wei, donate a large amount, watch the next depositor mint zero — cannot be primed.
Rests on The accounting. Note the two guarantees interact: with donations already invisible to pricing, the virtual share is defence in depth rather than the primary control, and a page that presents it as the primary control has explained the wrong mechanism.
The protocol cut has a hard cap
holdsThe cut is applied to harvested fee income and cannot be set above a constant compiled into the contract, by the owner or by anyone else.
Rests on The constant. But a cap on the rate is not a cap on the fee: the basis matters as much as the rate, and both are published on /umbo.
Nothing can move principal
holdsThe sweep path can only move assets in excess of what shareholders are owed. The backing of the outstanding supply is not reachable from any privileged call.
Rests on The accounting, plus the assumption that the excess calculation is right. This is the property most worth attacking and it has had no external review.
One key sets the harvester and the fee
gapAn owner address can point the vault at a harvester and can move the protocol cut anywhere below the cap. That is a trust assumption, it is not removed by any of the four properties above, and it belongs in this list rather than in a paragraph on another page.
Rests on Nothing. This is the gap, stated where the guarantees are.
Adductor
The adductor is the muscle that closes a shell. It stops what is being taken in; it does not remove anything already deposited. The stop is scoped the same way.
- Stops: deposits, mints, and harvests.
- Does not stop: redemption. A pause that traps depositors is not a safety control, it is the incident.
- Cannot: move assets, change the fee, or alter the share price.
Who holds that authority is unset, and whether it is one key is
unset. Both are on Umbo rather than described
as “decentralised” here.
Known limits
- No audit, no formal verification, no bug bounty, no testnet history.
- The share price cannot represent a loss on the underlying position — see Lustre. This is the largest open issue in the design.
- Nothing pays for a harvest, so the accrual the whole model depends on has no guaranteed caller.
- A promise about this contract is not a promise about a dependency. If assets are ever routed into a third-party venue, that venue’s withdrawal behaviour becomes part of the redemption promise and this page will say so explicitly.
Disclosure
There is no security contact, because there is no deployed system and an unmonitored address is worse than none. Publishing one belongs with a deployment, and nothing on the roadmap holds value before Phase III.